Going Further: Flatness at the Rescue of Early Stopping for Adversarial Example Transferability

arXiv:2304.02688v2 Announce Type: replace
Abstract: Transferability is the property of adversarial examples to be misclassified by other models than the surrogate model for which they were crafted. Previous research has shown that early stopping the training of the surrogate model substantially increases transferability. A common hypothesis to explain this is that deep neural networks (DNNs) first learn robust features, which are more generic, thus a better surrogate. Then, at later epochs, DNNs learn non-robust features, which are more brittle, hence …

abstract adversarial adversarial examples arxiv cs.cv cs.lg example examples hypothesis property research stat.ml training type